ajinabraham.njsscan.eval_node.eval_nodejs

rules:
  - id: eval_nodejs
    patterns:
      - pattern-either:
          - pattern-inside: function ($REQ, $RES, ...) {...}
          - pattern-inside: function $FUNC($REQ, $RES, ...) {...}
          - pattern-inside: $X = function $FUNC($REQ, $RES, ...) {...}
          - pattern-inside: var $X = function $FUNC($REQ, $RES, ...) {...};
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, ...) {...})
      - pattern-either:
          - pattern: |
              new Function(..., <... $REQ.$QUERY.$VAR ...>, ...)
          - pattern: |
              new Function(..., <... $REQ.$QUERY ...>, ...)
          - pattern: |
              eval(..., <... $REQ.$QUERY.$VAR ...>, ...)
          - pattern: |
              eval(..., <... $REQ.$QUERY ...>, ...)
          - pattern: |
              setTimeout(..., <... $REQ.$QUERY.$VAR ...>, ...)
          - pattern: |
              setTimeout(..., <... $REQ.$QUERY ...>, ...)
          - pattern: |
              setInterval(..., <... $REQ.$QUERY.$VAR ...>, ...)
          - pattern: |
              setInterval(..., <... $REQ.$QUERY ...>, ...)
          - pattern: |
              $INP = <... $REQ.$QUERY.$VAR ...>;
              ...
              new Function(..., <... $INP ...>, ...)
          - pattern: |
              $INP = <... $REQ.$QUERY ...>;
              ...
              new Function(..., <... $INP ...>, ...)
          - pattern: |
              $INP = <... $REQ.$QUERY.$VAR ...>;
              ...
              eval(..., <... $INP ...>, ...)
          - pattern: |
              $INP = <... $REQ.$QUERY ...>;
              ...
              eval(..., <... $INP ...>, ...)
          - pattern: |
              $INP = <... $REQ.$QUERY.$VAR ...>;
              ...
              setTimeout(..., <... $INP ...>, ...)
          - pattern: |
              $INP = <... $REQ.$QUERY ...>;
              ...
              setTimeout(..., <... $INP ...>, ...)
          - pattern: |
              $INP = <... $REQ.$QUERY.$VAR ...>;
              ...
              setInterval(..., <... $INP ...>, ...)
          - pattern: |
              $INP = <... $REQ.$QUERY ...>;
              ...
              setInterval(..., <... $INP ...>, ...)
    message: User controlled data in eval() or similar functions may result in
      Server Side Injection or Remote Code Injection
    languages:
      - javascript
    severity: ERROR
    metadata:
      owasp-web: a1
      cwe: cwe-95
      license: LGPL-3.0-or-later